Executive brief
A vulnerability was identified in the Linux kernel's USB gadget driver (NCM function) that could lead to a system crash. When a USB device is repeatedly connected and disconnected, certain internal data structures can become corrupted. If a subsequent connection attempt fails, the system may attempt to access invalid memory, resulting in a 'NULL pointer dereference' and a kernel panic.
Technical details
A vulnerability exists in the f_ncm USB gadget function driver within the Linux kernel. The root cause is a stale pointer in 'ncm->notify_req' that persists after a bind/unbind cycle. If a subsequent bind operation fails, the unified error handling label attempts to free this stale request, leading to a NULL pointer dereference when accessing 'ep->ops->free_request'. The fix refactors the bind path to utilize the '__free()' automatic cleanup mechanism to ensure proper resource management. This issue affects systems using the USB NCM gadget driver and can be exploited by a local user to cause a kernel panic (Denial of Service).
Affected products
- Linux Linux Kernel 2.6.38 to 6.17.5
Timeline
- 2025-10-30: advisory: Initial NVD publication
- 2025-10-29: patched: Patch committed to stable tree by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/185193a4714aa9c78437a7a1858fbe5771f0f45c
- https://git.kernel.org/stable/c/1cde4516295a030cb8ab4c93114ca3b6c3c6a1e2
- https://git.kernel.org/stable/c/75a5b8d4ddd4eb6b16cb0b475d14ff4ae64295ef
- https://git.kernel.org/stable/c/d3fe7143928d8dfa2ec7bac9f906b48bc75b98ee
- https://git.kernel.org/stable/c/ed78f4d6079d872432b1ed54f155ef61965d3137
- https://git.kernel.org/stable/c/f37de8dec6a4c379b4b8486003a1de00ff8cff3b